Install latest GPG version (the one MacOS ships with is out of date):
$ brew install gpg2 gnupg pinentry-mac
Create a new GPG key
$ gpg --full-generate-key
Keys can be listed with
$ gpg --list-secret-keys --keyid-format LONG
/Users/awo/.gnupg/pubring.kbx
-----------------------------
sec rsa4096/2634D0430EC71B8E 2020-02-07 [SC]
07DB46EAF90F61DD2B5061BA2634D0430EC71B8E
uid [ultimate] Anders Wiberg Olsen (GPG for Git) <[email protected]>
ssb rsa4096/4B1E495EE34CDD95 2020-02-07 [E]
Copy 2634D0430EC71B8E
(after sec rsa4096/
) and paste into .gitconfig
:
[user]
name = Anders Wiberg Olsen
email = [email protected]
signingkey = 2634D0430EC71B8E
Then, copy your key:
$ gpg --armor --export 2634D0430EC71B8E | pbcopy
Go to Setting on Github and add your GPG key there.
To force git to always sign the commits, edit your .gitconfig
:
[commit]
gpgsign = true
[gpg]
program = true
Now we need to ensure GPG actually works. In your ~/.bashrc
, ~/.bash_profile
or ~/.zshrc
, add the following line:
...
export GPG_TTY=`tty`
...
Pinentry makes it so you don't have to keep typing your password all the time.
Insert into ~/.gnupg/gpg-agent.conf
following line (files and directories might not exist already):
pinentry-program /usr/local/bin/pinentry-mac
Insert into ~/.gnupg/gpg.conf
following line:
use-agent
If you had to create the ~./gnupg
directory, give it the correct permissions:
chmod 700 ~/.gnupg